GHSA-2rh4-xgmq-63jp
XXE vulnerability in Jenkins Parasoft Findings Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.parasoft:parasoft-findings | < 10.4.4 | 10.4.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with [Warnings Plugin](https://plugins.jenkins.io/warnings) (10.4.1 and earlier) and [Warnings NG Plugin](https://plugins.jenkins.io/warnings-ng) (10.4.2 and newer).
Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Parasoft Findings Plugin 10.4.4 disables external entity resolution for its XML parser.
References
External links from the advisory. They lead to third-party sites.